Where did the key come from? Leaked by the application or something else?

..edit, found out they hard coded the string as constant in the app, smh.